# CVE-2026-56865: Go malicious GOPROXY sumdb tile forgery bypass

Source: https://junglewise.ai/threats/cve-2026-56865-go-malicious-goproxy-sumdb-tile-forgery-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-56865 · Severity: high · CVSS 8.4 · Published 2026-08-13

Go developers rely on a transparency log (GOSUMDB) to verify that downloaded software modules have not been tampered with. A malicious proxy server could forge verification data to trick developers into caching compromised code that would pass the security check. This could allow attackers to inject malware into developers' local environments that would persist across builds.

Technologies: [toolchain (Go)](https://junglewise.ai/threats/technologies/toolchain). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-56865 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56865 being exploited in the wild.

**How severe is CVE-2026-56865?** High severity, with a CVSS score of 8.4, published 13 August 2026.

**Which products and versions are affected?** golang.org/x/mod (Go) SEMVER:introduced=0,fixed=0.40.0; toolchain (Go) SEMVER:introduced=0,fixed=1.25.13,introduced=1.26.0-0,fixed=1.26.6,introduced=1.27.0-0,fixed=1.27.0-rc.3.

**Is there a fix for CVE-2026-56865?** Yes. golang.org/x/mod (Go): upgrade to 0.40.0 or later; toolchain (Go): upgrade to 1.27.0-rc.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56865 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56865?** Check whether you run golang.org/x/mod (Go) or toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- golang.org/x/mod (Go): upgrade to 0.40.0 or later

  ```sh
  go get golang.org/x/mod@v0.40.0
  ```

- toolchain (Go): upgrade to 1.27.0-rc.3 or later

  ```sh
  go get toolchain@v1.27.0-rc.3
  ```


## Technical details

The vulnerability exists in Go's sumdb (sum database) tile verification logic. A malicious GOPROXY server could forge up to two sumdb tiles, allowing a requested module to bypass GOSUMDB verification checks and persist attacker-controlled content in the local Go module cache. The root cause is incomplete verification of tiles against their parent entries in the transparency log, permitting an attacker to inject false verification data. The attack requires network access to a compromised or attacker-controlled GOPROXY. Go modules downloaded through such a proxy could be cached locally with forged verification checksums that appear valid. The issue has been patched; tiles are now correctly verified against their parents.

## Affected products

- Google Go prior to fix (2026-08-13)

## Identifiers

- CVE-2026-56865
- GO-2026-6179

## Timeline

- 2026-08-13: disclosed: CVE-2026-56865 disclosed

## References

- [https://pkg.go.dev/](https://pkg.go.dev/)
- [https://go.dev/cl/814960](https://go.dev/cl/814960)

## Related threats

- [Go cgo LDFLAGS validation bypass in cmd/cgo](https://junglewise.ai/threats/cve-2026-97043-building-a-malicious-package-that-uses-cgo-could-bypass-cgo)
- [Go compiler unsafe library path validation in Windows linker](https://junglewise.ai/threats/cve-2026-97042-building-a-malicious-package-that-uses-go-cgo-import-dynamic-or)
- [Go compiler cgo linker flag injection via directives](https://junglewise.ai/threats/cve-2026-97041-building-a-malicious-package-containing-go-cgo-compiler)
- [Go linker arbitrary flag injection via crafted .syso files](https://junglewise.ai/threats/cve-2026-97040-building-a-package-containing-a-crafted-syso-file-could-bypass)
- [Go command unsafe pkg-config flag handling in cgo](https://junglewise.ai/threats/cve-2026-97039-building-a-malicious-package-that-uses-cgo-pkg-config-directives)